Description

Detects dangerous use of Python's exec() function with user-controlled input, which could allow attackers to execute arbitrary Python code. This represents a critical remote code execution vulnerability that could give attackers full control of the application server.

Detection Strategy

• Identifies direct calls to Python's exec() function

• Checks if the first argument to exec() contains user-controlled input

• Also detects when string.format() is used on user input before being passed to exec()

• Reports a vulnerability when exec() executes content that can be controlled by user input

Vulnerable code example

from flask import Flask, request

app = Flask(__name__)

@app.route("/run", methods=["POST"])
def run_code():
    code = request.form.get("code", "")
    # VULNERABLE: Direct execution of user-controlled input...

✅ Secure code example

from flask import Flask, request, jsonify

app = Flask(__name__)

# Whitelist of allowed operations and their implementations
ALLOWED_OPERATIONS = {
    'add': lambda x, y: x + y,
    'subtract': lambda x, y: x - y,...